ACE — frequently asked questions

Network Load Balancer health checks only determine if an instance receives traffic. They do not trigger the deletion and recreation of the VM instance itself.

No. Autoscaling adjusts the number of instances based on load metrics. Autohealing is a separate setting within the MIG that monitors health and replaces unhealthy instances.

Coldline is optimized for cost and infrequent access, lacking the high availability and rapid retrieval capabilities needed when restoring operations after a disaster.

Backup storage focuses on long-term retention and cost, while disaster recovery storage prioritizes immediate availability and accessibility to resume operations quickly.

No. Standard lifecycle management transitions do not update the object's timeCreated metadata. The age continues to count from the original creation.

gsutil rewrite is a manual command for immediate execution. It cannot automate recurring rules like deleting objects after one year based on their age.

The button triggers a download of an RDP config file or redirects to instructions for using a local client; it does not host an interactive RDP session in the browser.

No, port 22 is for SSH (Linux). RDP uses port 3389, which must be open in the firewall rules.

While you can authenticate to different accounts, gcloud configurations allow you to save specific project, region, and zone defaults per account, making it easier to run commands without re-specifying flags.

'config set' modifies the currently active configuration's properties. 'configurations create' creates an entirely new named configuration profile that can be activated later.

A group lets you add or remove all auditors centrally in one place when an audit engagement starts or ends, instead of editing IAM bindings for each user account separately.

Google's auditing job-function guidance says predefined roles like logging.viewer and bigQuery.dataViewer are already vetted for the auditor use case, so you avoid the maintenance burden of defining and updating custom permissions.

Google Cloud has no automatic enablement for disabled APIs; a first call to a disabled API simply fails until an admin enables it for the project.

It forces the app to hold serviceusage.services.enable plus a broad admin role at runtime, violating least privilege when a one-time Console enable step suffices.

Groups filter resources inside an existing workspace using labels and metadata criteria; they cannot attach new projects to a Stackdriver account, so other projects' metrics would still go uncollected.

No. Shared VPC links project networks for traffic, not monitoring data; dashboards consolidate only when the projects are linked as monitored projects in one workspace.

With autoscaling off, the MIG's target size is fixed but not actively enforced. A community member tested this in the GCP console and confirmed that deleting an instance did NOT trigger recreation when autoscaling was disabled.

Autohealing detects unhealthy instances via health checks and replaces them, while autoscaling enforces the minimum and maximum instance counts. The question doesn't mention autohealing, so autoscaling is the intended mechanism for guaranteed availability.

Option A describes the desired end state but never establishes how those credentials are obtained off-cloud. Without generating a key pair first, the on-premises application has nothing to authenticate with, making B the actionable answer.

Interconnect provides network connectivity and private routing, not identity. Authentication to AutoML still requires the service account to present a key-derived access token, so option C answers the wrong problem.

Because the Cloud SDK installed from the Google Cloud Ubuntu apt repository has its Component Manager disabled. gcloud returns an error telling you to install optional components through the package manager instead.

Use sudo apt-get install google-cloud-sdk-datastore-emulator. It adds the Datastore emulator component, which you then start with the gcloud beta emulators datastore start command for local testing.

Compute Engine instance templates are immutable; you must create a new template and update the MIG to use it. Setting autoDelete requires a replacement template.

A leftover disk with a matching name can block MIG instance creation; deleting it clears the name collision so the new template can create instances.

The iam.serviceAccountKeyExpiryHours constraint does not accept DENY values, so option D is invalid at the policy level. Use the supported expiry-hours constraint instead.

No; rotation creates replacement keys on a schedule but does not cap each key's lifetime, and it adds runtime cost, so option A misses the enforcement requirement.

2FA protects Google identities, but it does not itself require OS Login on Compute Engine or enforce a consistent policy across projects. It complements, rather than replaces, organization-policy enforcement.

Project or instance metadata keys must be distributed and rotated manually, and they are not tied to IAM identities the way OS Login sessions are, weakening centralized audit control.

Autopilot provisions and scales nodes automatically, so you cannot pin a specific number of Compute Engine instances. HPA and VPA only adjust Pods or resource requests, not the node count.

No. Cloud Run instance settings bound the number of serving instances, but Cloud Run abstracts the underlying infrastructure, so you do not control Compute Engine node counts.

A private zone is only visible to the VPC networks it is authorized for. On-premises resolvers need the inbound server policy forwarding path over Cloud VPN to reach Cloud DNS.

A public zone publishes the record to global resolvers, so the name becomes resolvable from the public internet — exactly what the requirement forbids.

It lists service accounts within a project, not their keys, and its createTime refers to the service account rather than any key. It also is not an organization-wide Cloud Asset Inventory search.

Use iam.googleapis.com/ServiceAccountKey, not apikeys.googleapis.com/Key, which represents API keys. The ServiceAccountKey asset type exposes key metadata such as createTime for age filtering.

Git is not designed for high-concurrency writes or locking. Storing state there can lead to corruption and may inadvertently commit sensitive plaintext secrets into version history.

Cloud Storage provides durable object storage. For robust locking, it is often paired with Cloud Datastore/Firestore or uses backend-specific locking implementations provided by the Terraform provider.

No, detailed billing exports provide data but do not generate separate legal invoices from Google. Separate Billing Accounts are required for distinct invoicing.

The scenario explicitly requires all resources to be centrally managed under a 'single Google Cloud organization', making multiple Orgs non-compliant with the prompt.

Cloud Profiler measures resource utilization and latency, not text-based error semantics or logic errors.

Only if the error is extremely new or niche; otherwise, Gemini provides instant, tailored analysis from known patterns.

A shared query only filters what a user chooses to run; anyone with broader logging.viewer access can simply change or clear the query and read logs the team should not see.

logging.viewAccessor grants read access only to logs exposed by the specific log view, while logging.viewer grants read access to all logs in the project or scope, which violates least privilege.

Editor grants full control over all resources in the project. roles/iam.serviceAccountAdmin is scoped only to service account management, adhering to least privilege.

No, it only allows invoking (running) the Cloud Run service. It does not include permissions to change IAM policies for any resource.

That predefined role still grants many other instance-administration permissions, such as updating configuration and attaching disks. Only a custom role limits access to exactly the three required lifecycle actions.

No. compute.viewer is read-only; instance lifecycle actions require compute.instances.start, stop, and reset permissions, which a viewer role does not include.

Google Cloud does not attach a creator label automatically, and these projects predate the automated provisioning process that would have applied labeling conventions.

When a project is created in the console, the creating user is granted the Owner role by default, so the Owner entries on the IAM page point back to the creator.

daysSinceNoncurrentTime applies only to noncurrent (overwritten) versions. Archival records that are never overwritten stay as current versions, so the rule would never move them to Archive storage.

Cloud Storage lifecycle rules already do this automatically and for free. Custom code adds runtime costs, scheduling, IAM permissions, and failure points with no benefit over the built-in SetStorageClass action.

Among Cloud Storage classes suitable for rarely accessed, long-term retained data (Nearline, Coldline, Archive), Archive has the lowest storage cost per month, making it the right target for regulatory archives that are rarely retrieved.

A dry run via bq --dry_run or the API dryRun parameter returns the estimated number of bytes the query would process (bytes read) without executing it, so you can estimate on-demand cost beforehand.

On-demand pricing charges for bytes processed, not rows scanned. A COUNT(*) returns a row total, which cannot be converted to dollars because row sizes vary.

Take the bytes-read estimate from the dry run, convert it to TiB, and multiply by the current on-demand rate using the Google Cloud Pricing Calculator.